Towards Operational Measures of Computer Security.pdfVIP

Towards Operational Measures of Computer Security Bev Littlewood Sarah Brocklehurst Norman Fenton Peter Mellor Stella Page David Wright Centre for Software Reliability City University Northampton Square London EC1V 0HB John Dobson Computing Laboratory University of Newcastle-upon-Tyne Newcastle-upon-Tyne NE1 7RU John McDermid Dept of Computer Science University of York Heslington York Y01 5DD Dieter Gollmann Dept of Computer Science Royal Holloway and Bedford New College Egham Hill Egham TW20 0EX Abstract Ideally, a measure of the security of a system should capture quantitatively the intuitive notion of ‘the ability of the system to resist attack’. That is, it should be operational, reflecting the degree to which the system can be expected to remain free of security breaches under particular conditions of operation (including attack). Instead, current security levels at best merely reflect the extensiveness of safeguards introduced during the design and developme